NIST 800-171: Requirements, Rev 2 vs Rev 3, and SPRS Scoring (2026)

NIST 800-171 Rev 2 vs Rev 3 at a glance, status checked October 24, 2026:

What NIST 800-171 is (and what CUI is)

NIST 800-171 is a set of security requirements, written by the US National Institute of Standards and Technology (NIST), for protecting the confidentiality of CUI when it sits on a nonfederal system, such as a defense contractor’s network. NIST built it by starting from the SP 800-53 controls in the SP 800-53B moderate baseline and tailoring out what doesn’t apply outside government (Rev 3, section 2.2).

Controlled unclassified information (CUI) is government information that isn’t classified but still needs safeguarding or dissemination controls under a law, regulation or government-wide policy. Examples include controlled technical information such as engineering drawings. The National Archives keeps the official list of categories in the CUI Registry.

Who must comply with NIST 800-171

You must comply with NIST 800-171 when a federal contract requires it, which in practice means most DoD contractors and subcontractors that handle CUI.

• DoD contractors: DFARS 252.204-7012 requires “adequate security” for covered defense information, defined as implementing NIST SP 800-171. The clause flows down to subcontractors that handle that information.
• Other agencies: 32 CFR 2002.14 says agencies “must use NIST SP 800-171” when setting requirements to protect CUI on nonfederal systems, so civilian contracts can carry it too.
• Bidders: as of October 24, 2026, DoD’s part 240 deviation has dropped the old 252.204-7019 basic self-assessment notice; a self-assessment score goes into SPRS when a solicitation names CMMC Level 2 (Self), and it must be no more than 3 years old.

If you also need CMMC, see how CMMC levels and certification work.

NIST 800-171 Rev 2 vs Rev 3

NIST 800-171 Rev 3 is NIST’s current version, with 97 active requirements in 17 families, but DoD still requires Rev 2’s 110. NIST published Rev 3 on May 14, 2024 and withdrew Rev 2 the same day.

DoD moved first. On May 2, 2024 it issued class deviation 2024-O0013 (revised May 22, 2024), pinning DFARS 252.204-7012 to Revision 2 “instead of the version of NIST SP 800-171 in effect at the time the solicitation is issued.” DoD has since archived that deviation. As of October 24, 2026, the DFARS part 240 deviation of its Revolutionary FAR Overhaul (2026-O0025, Revision 3, September 3, 2026) carries the 7012 clause naming Revision 2, requires “baseline compliance with NIST SP 800-171 Rev 2,” and “remains in effect until rescinded or incorporated” into the DFARS.

What changed in Rev 3:

• Fewer, bigger requirements. Rev 3 keeps Rev 2’s numbering but marks 33 of its 130 IDs as withdrawn, mostly by folding them into other requirements (our count).
• Three new families: Planning (03.15), System and Services Acquisition (03.16) and Supply Chain Risk Management (03.17).
• Organization-defined parameters. Many Rev 3 requirements let the organization (for DoD work, the agency) set values such as review frequencies.

Our advice: build to Rev 2 for DoD work today, and read the Rev 3 changes so the eventual switch isn’t a surprise.

The 14 NIST 800-171 requirement families (Rev 2)

NIST 800-171 Rev 2 groups its 110 requirements into 14 families, and Access Control is the largest with 22.

The full requirement text is free in NIST SP 800-171 Rev 2. Rev 3 adds Planning, System and Services Acquisition, and Supply Chain Risk Management.

NIST 800-171 and CMMC

CMMC Level 2 is DoD’s check that a contractor meets all 110 NIST 800-171 Rev 2 requirements. DoD suspended CMMC Phase II on July 13, 2026, so as of October 24, 2026 a contract may require the Level 2 self-assessment but not a third-party (C3PAO) assessment. Assessment steps, POA&M rules and DoD’s cost estimates are in our CMMC Level 2 guide.

How SPRS scoring works

A NIST 800-171 SPRS score starts at 110 and loses 5, 3 or 1 points for each requirement not met, so it can go below zero. The weights come from DoD’s NIST SP 800-171 DoD Assessment Methodology (version 1.2.1), which CMMC reuses in 32 CFR 170.24.

• Lowest possible score: -203. DoD says only that the score “may result in a negative score”; the floor is our arithmetic from its weights (the table’s counts are ours too).
• Partial credit exists in two places. Multifactor authentication (3.5.3) loses 3 points if it covers only remote and privileged users, 5 if it covers no one. Encryption that isn’t FIPS-validated (3.13.11) loses 3; no encryption loses 5.
• What gets posted: the summary score, the assessment date, and the date all requirements are expected to be met (DFARS 252.240-7997, for DoD Medium and High assessments).

Worked example: a company missing MFA entirely (−5), the ability to trace actions to individual users (3.3.2, −3) and two 1-point items (−2) scores 100.

How to comply: SSP, POA&M and self-assessment

To comply with NIST 800-171, document how each requirement is met in a system security plan, list the gaps in a plan of action, then score yourself with DoD’s methodology and post the result in SPRS.

1. Scope: find every system that stores, processes or sends CUI. A smaller enclave means fewer systems to secure.
2. Write the system security plan (SSP): one entry per requirement, saying how it is met.
3. Assess: test each requirement against NIST SP 800-171A, the companion assessment procedures.
4. Plan the gaps: a plan of action and milestones (POA&M) for each unmet requirement. Under CMMC, open items must close within 180 days.
5. Score and post: enter the summary score in SPRS when a contract names CMMC Level 2 (Self), and redo it at least every 3 years.

Compliance software that maps NIST 800-171 can hold the SSP, POA&M and evidence in one place.

What NIST 800-171 compliance costs

NIST 800-171 compliance software lists at $8,000 a year for a single framework at Strike Graph and $7,500 at Drata, on AWS Marketplace, checked October 24, 2026. These are list prices, not negotiated ones.

Software is the smaller part of the bill. The fixes themselves (MFA, logging, FIPS-validated encryption, a CUI enclave) depend on your starting point. DoD publishes its own CMMC assessment cost estimates, which leave out the cost of meeting the requirements; our CMMC Level 2 guide lists them.

NIST 800-171 vs NIST 800-53

NIST 800-53 is the full catalog of security and privacy controls for federal systems; NIST 800-171 is a smaller, tailored set of requirements for protecting CUI on nonfederal systems.

For a voluntary, organization-wide framework rather than a contract requirement, NIST also publishes the NIST Cybersecurity Framework (CSF).